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Abstract. We describe and give computational results of a procedure to com- 
pute the divisor class number and regulator of most purely cubic function fields 
of unit rank 2. Our implementation is an improvement to Pollard's Kanga- 
roo method in infrastructures, using distribution results of class numbers as 
well as information on the congruence class of the divisor class number, and an 
adaptation that efficiently navigates these torus-shaped infrastructures. More- 
over, this is the first time that an efficient "square-root" algorithm has been 
applied to the infrastructure of a global field of unit rank 2. With the ex- 
ception of certain function fields defined by Picard curves, our examples are 
the largest known divisor class numbers and regulators ever computed for a 
function field of genus 3. 

1. Introduction and Motivation 

One of the more diiEcult problems in arithmetic geometry is the computation 
of the divisor class number of an algebraic curve over a finite field. In this paper, 
we give results on the application and optimization of a method of Scheidler and 
Stein [21] [22] , combined with modifications to Pollard's Kangaroo algorithm [15] , 
to compute the exponent of the infrastructure of a purely cubic function field with 
complete splitting at infinity (i.e., unit rank 2) over a large base field. The regulator 
and the divisor class number are multiples of this exponent, and in many cases all 
three numbers are the same, whence our algorithm computes the regulator and the 
divisor class number in these cases as well. Our method greatly improves upon 
the method described in [12] to compute the regulator in this setting and is the 
first ever treatment of an efficient "square-root" algorithm in a two-dimensional 
infrastructure of a global field. 

An algorithm due to Stein and Williams [50] uses techniques of Lenstra [13] and 
Schoof [23] to compute the divisor class number and regulator of a real quadratic 
function field in O (q'[(2ff-i)/5l+e(9)j infrastructure operations, where —1/4 < 
£{g) < 1/2. This method was improved by Stein and Teske [271|28l|2^, who applied 
the Kangaroo algorithm to compute the 29-digit class number and regulator of a 
real quadratic function field of genus 3. 

The algorithm of [30j was generalized to cubic and arbitrary function fields in 
[211 [22] , respectively, and implemented in purely cubic function fields of unit rank 
and 1 in jllj . In this paper, we provide an implementation and numerical examples 
for purely cubic function fields of unit rank 2. Our method is applied to compute 
divisor class numbers and regulators of up to 31 digits of function fields of genus 3. 
With the exception of the 55-digit class numbers computed by Bauer, Teske, and 
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Weng in [4l |35] for cubic function function fields generated by Picard curves, our 
examples are the largest known class numbers and regulators ever computed for a 
function field of genus at least 3 over a large base field. 

The remainder of this paper is organized as follows. We first give an overview 
of cubic function fields and their infrastructure. Then we outline our version of 
Pollard's Kangaroo method for infrastructures, and explain how to recover the 
regulator and divisor class number in most cases. Finally, we discuss details of our 
implementation and provide numerical results. 

2. Cubic Function Fields 

For a general introduction to function fields, we direct the reader to p ^ l31 ] [T6 ] . 
Explicit details of purely cubic function fields and their arithmetic can be found in 
[SQllTlllTlllllEl]. Let be a finite field and ¥q{x) the field of rational functions in 
X over ¥q. Throughout this paper, we assume that char(Fq) > 5. A cubic function 
field is a separable extension K/¥q{x) of degree 3; we denote by g the genus of K. 
A function field is purely cubic if it is of the form K = ¥q{x, y) where y'^ = F for 
some cube-free F G Fg [x] . 

2.1. Divisors and Ideals. Let T) denote the group of divisors of K defined over 
Fq, 2?o the subgroup of divisors of degree defined over Fq, and V the subgroup 
of principal divisors defined over ¥q. Then the {degree 0) divisor class group of K 
is the quotient group = T^a/V and its order h — \J'\ is the {degree 0) divisor 
class number of K. Let S be the set of places of K lying above the place at infinity 
of ¥q{x), supp(i:») the support of D e V, ^ {D ^ \ supp(£)) C S}, and 
^ V n Vq . Then the order R of the quotient group 2?q /V^ is the {S-)regulator 
of K. Finally, let Vg = {D & V \ supp(i:)) C^ S = and Vs = V C^ Vs. Then 
every D £ V can be uniquely written in the form D = Dg + with Dg g Vs 
and D'"^ eV^. 

The maximal order of K/¥q{x) is the integral closure of Fq[a;] in K and is denoted 
O. Let I denote the group of non-zero fractional ideals of O and H the subgroup 
of non-zero principal fractional ideals. The ideal class group of K is the quotient 
group Cl{0) — T/H, and its order ho ~ \CI{0)\ is called the ideal class number oi 
K. Let / be the greatest common divisor of the degrees of all the places in S. By 
Schmidt [25 (see also Proposition 14.1 of |I6]) there is an exact sequence 

(0) ^ V^/V^ -^J^ Cl{0) -L/fL (0) , 

so that fh — hoR- 

There is a well-known isomorphism $ : Vs ~^ X given by D i— > {a G K* \ 
div(a)5 > ~D} with inverse f i— ?> — X^p^s'^pP' where p denotes any finite place 
of K, nip — min{i;p(a) | 7^ a € f}, and Vp is the normalized discrete valuation 
corresponding to p. Moreover, $ induces an isomorphism from Vs/Vs to Cl{0). 
If S contains an infinite place ooq of degree 1, then $ can be extended to an 
isomorphism 

^' : { Z) e X>o I wpl^*) = for aU p e 5 \ {ooq} } ^ I 

by ^{Ds - deg(L's)cx)o) = $(-Ds), with the inverse given by *"^(f) $"^(f) + 
deg(7Vif/F,(x)(f))ooo. 
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2.2. Units. By Proposition 14.1 and its Corollary 1 of 16 , O* /W*^ ^V^' isa free 
abelian group of rank r — \S\ — 1. We write S = {ooq, . . . ,oo,.} to denote the 
infinite places of K, with Wj the normalized discrete valuation corresponding to 00^, 
for < J < r. A set of generators of the free part of O* is called a system of 
fundamental units of O and we write {ei, . . . , e^} for a given system of fundamental 
units. 

We now restrict to the case r — 2, i.e., unit rank 2. Given any system of funda- 
mental units {£1,62}, consider the 2x2 matrix M — (wi(ej))i<ij<2. If we trans- 
form M into Hermite Normal Form, then the resulting matrix entries correspond 
to valuations of another system of fundamental units, {771, 772}. This system is inde- 
pendent of the original system, and is unique up to constants in F*. Furthermore, 

= (001-000,002-000) and i?= P^/V^l =det{M) =viir]i)v2im)- 
For the remainder of this paper, we assume that S contains an infinite place ooo 
of degree 1, so that f — 1 and h = hoR- In this case, ho is generally very small, 
so we operate in another set of ideals called the infrastructure of K . To that end, 
we require the notion of a distinguished divisor and ideal. 

2.3. Distinguished Divisors and Infrastructure. Let K he a cubic function 
field with an infinite place ooo of degree 1 and maximal order O. A divisor D of K 
is said to be finitely effective if Dg > 0; that is, Vp{D) > for all finite places p of 
K. Following [SJIHIIII], a finitely effective divisor D is defined to be distinguished if 

(1) D is of the form D ~ Ds — deg(Ds)ooo, and 

(2) if E is any finitely effective divisor equivalent to D with deg {Es) < deg {Ds) 
and E^ >D^, then D = E. 

A fractional ideal f of O is said to be distinguished if \E'~^(f) is a distinguished 
divisor. Note that distinguished ideals are called reduced in [TTl [20l [TSl fT2l l6l [7] . 

A general treatment of infrastructures in function field extensions of arbitrary 
degree can be found in [HI . The cubic scenario was first presented in [SUl [Ml HI] j 
and we use a description based on [TT] here. 

By fTP, Lemma 3.3.12 and Theorem 3.3.16], if is a cubic function field with an 
infinite place of degree 1, then every divisor class contains at most one distinguished 
divisor. (In fact, almost all divisor classes contain a distinguished divisor; see [8].) 
This gives rise to the following definition. The (finite) set 

7t := {f e "H I f is distinguished} 

is the (principal) infrastructure of O (or of K). While we use an ideal-theoretic 
definition of TZ here, the isomorphism 4" can be used to translate this into divisor- 
theoretic language. In particular, IZ is in one-to-one correspondence with the set 
of distinguished representatives of the kernel of the map J — )■ Cl{0). 

Henceforth, we will restrict to the case r = 2. We consider the lattice A 
((7;i(?7i), 0), {vi{rj2)TV2{ri2))) C 1? . If f e 72., then there is a function a £ K* such 
that f = The coset (■i;i(Q;), ^2(0;)) -I- A is uniquely determined by f. We 

define the distance off to be (5(f) := ((5i(f), (52(f)) -I- A := {vi{a),V2{a)) + A. Since 
(5 : 72. ^ Z^/A is injective, TZ can be thought of as a subset of 7? /A. In other words, 
TZ is structured as discrete points on the surface of a torus. 

In practice, we do not know A, and finding (5(f) given only f is computationally 
infeasible. We therefore define the (extended principal) infrastructure as 

7^ {(f, w) e 7^ X I (5(f) = t; + A}. 
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For a ~ (f, w) G TZ, call S{a) :— (5i(o), (52(a)) := v the distance and id(a) := f the 
ideal part of a. Finally, we will call wi(?7i) = exp(I?Q /T'"^) the exponent of 7?. and 
denote it exp(7?.). Since i? = wi(?7i)u2('72), we have exp(7?.) | R. 

2.4. Infrastructure Arithmetic. Infrastructures have two main operations: the 
baby step and giant step operations. Roughly speaking, a baby step maps an in- 
frastructure element to another element close to it, in terms of distance, while a 
giant step reduces the product of two distinguished ideals. We will also describe 
a third operation called the below operation, which finds an infrastructure element 
of (or close to and just below) a given distance. Moreover, these operations can be 
computed efficiently; for full details and proofs of this arithmetic in purely cubic 
function fields, we refer the reader to [20 l [T8 l [T2 l [3l ITT] . 

In unit rank 2 infrastructures, there are three types of baby steps as follows. Let 
f be a distinguished ideal of O and denote 

n^if) = {a e f I v,{a) < 0, Vj{a) > for ah j ^ i, 

and Vj{a) > for at least one j ^ i} ■ 

Following [201 [I2], let i e {0, 1, 2} and a,P &K*. Write a >, ^ if 

{v,{a),Vi+l{a),v^+2{a)) >iex {vi{(3),v^+i{(3),v^+2{l3)) , 
where the subscripts are considered modulo 3. The following theorem guarantees 
the existence and uniqueness (up to a factor in F*) of the maximal element of 'Hi(f) 
under the ordering >i. 

Theorem 1 (Theorem 3.4 of [12)1. Let O be the maximal order of a purely cubic 
function field K of unit rank 2 and f a distinguished fractional ideal of O. For any 
i £ {0,1,2}, there exists an element (j) = (j)i{f) S Jiiif), unique up to a factor in 
¥*, such that (f> '>i a for all a G 'Hi{f). Furthermore, {4>~^) f is also a distinguished 
fractional ideal. 

Let i e {0,1,2}. If a = (f,w) e 7^, </> = (?!),(f), and g = (0"^) f e 7^, then the 
operation a i— > b (g,w + (ui ((/>), ^2(0))) is called a baby step (in the i-direction), 
and we write bsi{a) ~ b. See also Figure [T] on how baby steps behave with high 
probability. 

The giant step operation is analogous to multiplication. If ai ~ (fi,wi), 02 — 
(f2,f2) € TZ, then fif2 is generally not distinguished. However, by [HI Theorem 
5.3.17], there is a function ip G K* such that Ui(V') > 0, for each i = 0,1,2, and 
wo(^/') + wi(V') + W2('0) < 25, yielding ai*a2 := {{'4>~^) fifs, wi +W2 + (wi(V'), «2('0))) e 
Tl. Thus, 5(ai*a2) = (5(ai)-|-(5(a2) + (wi(V'), W2(V')), so that 5(ai*a2) ^ (5(oi)+(5(a2). 
We call * the giant step operation. Under *, 7^ is an abelian group-like structure, 
failing only associativity, and by [8], existence of inverses for very few elements. 

A third required operation is the computation of the infrastructure element below 
any ordered pair (a, b) of integers a, & e N. This is the unique element B{a, b) :— 
a G TZ such that S{a) — {a — i,b) with i > minimal. From [8], it follows that 
S{B{a, b)) = (a, b) with probability 1 - 0(1 /q). 

Navigating TZ is not as straightforward as the cyclic infrastructures of fields of 
unit rank 1. This is due to the existence of "hidden" elements and "holes". An 
element in TZ is hidden if it cannot be reached via baby steps. A hole d € is 
an element that does not lie in the image of the distance map S, i.e., there exists 
no element a £ TZ with (5(a) — d. By ^, the probability of encountering a hidden 
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Figure 1 . The Typical Baby Step Behaviors According to Propo- 
sition [T](l) 
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Figure 2. Algorithm [T]- The Most Common Scenario 

O hole 
% % infrastructure dements 
V\ — 2—^ baby step in direction i 



Invoke Algorithm FTI here 

o 

0, 




element or a hole is 1 — 0{l/q). Therefore, the distance advances effected by a baby 
step and a giant step are generally predictable as follows. 

Proposition 1. Let K/¥q{x) be a cubic Junction field of genus g. 

(1) If a Cz TZ, then with probability 1 — 0{l/q), we have 

( (1,0) if 1 = , 
(5(5s,(a))- J(a) = <^ (-1,1) = 1 , 

[ (0,-1) ifi = 2 . 

(2) // ai = (f,wi), a2 = (f, W2) e TZ and ai * 02 ((-0^^) fif2, "3), so that 
S{ai * 02) = (5(oi) + (5(a2) + (ui (■(/'), V2{'4')), then with probability 1 — 0{l/q), 
we have 



L.9/3J .9 ^2 (mod 3) , 

(g + l)/3 1/ .9 = 2 (mod 3) . 

The proof follows from TT using [8 . The first statement is visualized in Figure[T] 
The majority of our computations will take place in the subset TZq := {a G 72. | 
(52 (fl) = 0} of 72.. As such, if we encounter an element b ^ TZq, either via a baby step 
or a giant step, then we must find an element in TZq close to b. Algorithm [T] finds 
such an element o € TZq with overwhelming probability and is based on Theorem [1] 
The idea of the algorithm is to first find an element of non-negative 2-distance. If 
the element has positive 2-distance at this point, then we expect that a step in 
the 0-direction followed by a series of steps in the 2-direction produces an element 
a e TZq with Si{a) > Si{b) and small 62(0) > 0. If at this point, (52(a) 0, we 
repeat the process until an element a £ TZq is found. Since the number of holes is 
very small by [5], one iteration almost always suffices. 

Figure [H illustrates the most common scenario in which Algorithm [T] is used, 
namely when we encounter a hole in TZ when taking a baby step in the 0-direction. 
This baby step generally results in an element with a 2-distance of 1. 

3. The Kangaroo Method in TZ 

If we are given integers E, U G N such that the divisor class number h G {E — 
U, E + U), then the Kangaroo method may be optimized to compute a multiple 



6 



F. FONTEIN, E. LANDQUIST, AND R. SCHEIDLER 



Algorithm 1 (redo) Finding an Element in TZq 
Input: An element b G TZ such that (52(b) 7^ 0. 

Output: An element redo(b) a G TZq close to b such that (52(a) ~ 
1: while (52(b) < do a := b, b := &si(o) 
2: while (52(b) > do /* Now 52(b) > 0. */ 
3: a := b, b := bso{a) 
4: while (52(b) > do a := b, b := bs2{a) 
5: if (52(b) < then b := a 
6: return a := b 



of expiJZ) with a probabilistic running time of 0[Vu) giant steps. While the 
Baby Step-Giant Step method is generally faster than the Kangaroo method, the 
Kangaroo method is preferred for larger computations because it requires very 
little storage and can be parallelized efficiently. Specifically, we will describe the 
parallelized Kangaroo method of van Oorschot and Wiener [531 US] and explain 
important improvements that apply in particular to operating in infrastructures of 
unit rank 2. After our description, we will optimize its running time in Theorem [2] 
Later, we will show how to determine the regulator R and the divisor class number 
h from exp(7?,) in many cases. 

There are two key elements to adapting the Kangaroo algorithm to infrastruc- 
tures of unit rank 2 function fields. Firstly, the units of O correspond to ele- 
ments {0,v) G TZ, where v £ A. Secondly, there exists a unit e G O* such that 
{vi{e),V2{e)) = {h,0); e = rjl, for some i £ N. Therefore, we restrict our search to 
elements a with (52(o) — 0, i.e., we operate in TZq C TZ. In FigurelH we illustrate the 
Kangaroo method in our setting. The vi and V2 axes are labeled to give a reference 
for distance. The black dots correspond to units, with 771, 772, and e labeled. The 
infrastructure TZ is the gray parallelogram on the left, with TZq the thick line at its 
base. Copies of TZ tile TZ in the wiW2-plane. A sample interval {E — U, E + U) is 
shown in the top figure, highlighted in gray, containing the unit e at {h,0). This 
interval is then expanded in the bottom figure to show how the Kangaroo method 
proceeds. Infrastructure elements (kangaroos) are initialized at {E,0) and {h,0), 
which then jump, via baby steps and giant steps, along the ui-axis until their paths 
merge. The jumps are represented by the arcs. Once these paths merge, a multi- 
ple of exp(7?,) can be determined, and from that we can determine exp(7?,) itself. 
This often makes it possible to determine R and h as well; in fact, in many cases 
exp(7^) = R = h (see the discussion in Section |4]). However, Figure [3] illustrates 
the most general situation. 

We now describe in detail a modification of the parallelized Kangaroo method 
using notation similar to that of [27l |29] for hyperelliptic function fields. Let m 
be the (even) number of available processors. The algorithm uses two herds of 
kangaroos: a herd {Ti, . . . , T„/2} of tame kangaroos and a herd {Wi, . . . , Wm/2} 
of wild kangaroos. A kangaroo is a sequence of elements in TZ, and we write Tj = 
{fyijlAGNo and Wk = {tDB^felsgNoi for ^ ^ j^k < m/2. Each tame and wild 
kangaroo is initialized via to j = B{E+{j — l)i', 0) G TZq and rDo,fe = -B((fc— l)j/, 0) G 
TZq, respectively, for some small v € Z. From these initial positions, the kangaroos 
make jumps (i.e., baby and giant steps) in TZq until a collision between a tame 
and a wild kangaroo occurs. That is, the kangaroos jump until a tame and a 
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Figure 3. The Kangaroo Method in Unit Rank 2 Infrastructures 
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wild kangaroo have the same ideal part. In this case, if id{tA,i) = id(fDs,,;'), for 
some A,B£ No and I < < m/2, then = Si{n)B,i') (mod exp(7^)), so 

ho := (5i(tA,i) — Si{^B,i') is a multiple of exp(7?,). 

To make the jumps, define a set of small (relative to U) random positive integers 
{si, . . . , S64}, the jump set J = {ai, . . . , 054}, where = B{s^ - ip^g), -■4){g)), for 
1 < i < 64, and a hash function w : 7?, — >■ {1, . . . , 64}. Also, for a real number 
T > 1, let 5t C 7?.o such that approximately every r-th element of TZo belongs to 
Sr- Each kangaroo jumps through TZo via an iteration of a giant step and possibly 
one or more baby steps. Initially, each tame and wild kangaroo will take baby 
steps, if necessary, until it is in Sr- Then each kangaroo takes the giant step 
ti+i ti * aw{ti), for I > 0, followed by baby steps in the 0-direction, correcting 
via Algorithm [T] if necessary, until an element in Sr is found. 

If there is a collision between two kangaroos of the same herd, then we must 
re-initialize one of the two kangaroos. If {; is one of two kangaroos in a collision, 
then choose a small c € N, set ti+i :— ii * B{c, —'({^{g)), and take baby steps until an 
element in Sr is found. Then t continues jumping on its new path as usual. The 
other kangaroo may continue without interruption. 

Using the idea of van Oorschot and Wiener |34) , we will only store distinguished 
points to reduce the storage requirement. In order to avoid confusion in terminology, 
such points will be called (kangaroo) traps instead. Let G N be a sufficiently large 
power of 2 and define another hash function z : TZo ^ {0, . . . , 9 — 1} . Set a trap, 
that is, store a kangaroo i, if z{i) = 0. Since kangaroos travel along the same path 
following a collision, any collision will eventually land in a trap. 

Finally, if there exist a, 6 G No, such that 6 > 1 and h = a (mod b), then we 
make adjustments to take advantage of this information. First, change the estimate 
E to E — {E (mod b)) + a, so that E = a (mod b) for the revised value of E. Next, 
choose ly and the Si such that b \ v and b\ Si, for each 1 < i < 64. Finally, restrict 
Sr to elements a G TZo such that 5i{a) = a (mod b) and require that approximately 
every 5r-th element of TZo lies in Sr ■ The remaining initializations and procedures 
are the same as before. 

In Algorithm [2l we formalize the procedures described above. The following 
result is a generalization of and an improvement upon similar ideas in |271 129j and 
establishes optimal choices for r and the average jump distance j3 = Mean{si) to 
minimize the expected heuristic running time of the Kangaroo method. The proof 
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Algorithm 2 Computing ho via the Kangaroo Algoritlim 

Input: A purely cubic function field K/¥q{x) of unit rank 2; a, b G No such that 
h = a (mod b) (or b — 1 and a = if no non-trivial 6 is known); and an even 
integer m, the number of processors. 

Output: A multiple ho of exp(7?.). 
1: Compute the genus g, choose p from Table [U and choose a :— a{g) from 
Table [H 

2: Set P [{m/2)^{2p-l)aU\ - p+1, := 5[2^/(6m)J, 6 := 2^^sWm^ j 
k := 0. 

3: Choose random integers g + 1 + ijj{g) < Sj < 2/3, with 1 < i < 64, such that 

Mean {{si}) = /3 and b \ Si. 
4: Compute the jump set J :— {ai, . . . , 004}, where := B{si — ^^(5), — V'(g)). 
5: while ^i(ai) 7^ s.; — ip{g) for any i do 

6: Replace Si :— st + b and recompute :— B{si — ip{g), —ipig)) for inclusion 
in J. 

7: Define hash functions w :Tl^ {1, . . . , 64} and z : TZ {0, . . . , — 1}. 
8: for i = 1 to m/2 do 

9: Initialize the tame kangaroos, T^: to.i + (i — 0). 

10: Initialize the wild kangaroos, Wi: tt)o,i := B((i — 0). 
11: while to.i ^ Sr do to,; := redo(6so(to,j))- 
12: while rDo,i ^ Sr do roo.i redo(6so(tt'o,i))- 

13: while a collision between a tame and a wild kangaroo has not been found do 
14: for i = 1 to r7i/2 do 

15: if z{lj^i) = or z{nik,i) — then store the respective element(s). 

16: Compute tj+iA := redo(tj,j * <^w{ij_i)) and rDfe+i,^ := redo(rDfe,i * o^,(„j^^)). 

17: while tj+i^i ^ Sr do tj+i,^ := Tedo{bso{ij+i^i))- 

18: while rDfe+i,i ^ Sr do rofc+i^i := redo(6so(rDfe+i,i)). 

19: Increment j := j + I and k := k + I. 

20: if = ros.i' then return /iq := (5i(U,i) - 5i(rDs,i')- 



is similar to the analogous result in cubic function fields of unit rank 1. We therefore 
omit the proof and refer the reader to pTj . 

Theorem 2. Let K/¥q{x) be a purely cubic function field of unit rank 2 such that 
h = a (mod b) for some a, 6 G N. Then the expected heuristic running time, over 
all cubic function fields over ¥q{x) of genus g, to compute a multiple ho of exp{TZ) 
via Algorithm\^ is minimized by choosing r = p/b and an average jump distance 
of 13= [{m/2)^(2p-l)aU\ - p+l. Here, m is the (even) number of processors, 
p = Tg/Tb, Tg and Tb are the respective times required to compute a giant step 
and a baby step in TZ, and a = a{q, g) < 1/2 is the mean value of \h — E\/U over 
all cubic function fields over ¥q{x) of genus g. With these choices, the expected 
heuristic running time IS {4:y/aU/{2p- 1) + 0m + 0(1))(2 - 1/p)Tg, as q ^ 00, 
where traps are set on average every 9 iterations. 

Following the recommendations given in [331 [13] , we make choices for the remain- 
ing variables. First, we choose the Si randomly such that 5 -I- 1 -|- ipig) ^ Si < 2/3, 
for 1 < i < 64. (The lower bound is an application of Theorem 5.3.10 of [H] 
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97 


2 


0.12602172 



Table 1. Giant Step to Baby Step Ratio p = Tq/Tb and Estimate 6i{g) 
of Mean{\h~ E\/U) 



to guarantee that (0,(0,0)) ^ J.) The choice of |J| = 64 as a power of 2 en- 
sures that the hash function w is fast, and is large enough to obtain a sufficient 
level of randomization, but small enough so that the space to store the jumps is 
not too large. We also chose the spacing v ^ 2(3 /m. For setting traps, we took 

some small integer c. The hash functions w and z 
are defined using an Fq[a;]-module representation of the ideal component of each 
element in 7?,; for details, see [TT] . 

Table [T] lists values of p for various unit rank 2 situations of genera 2 < g < 7. 
In each case, we computed the ratios using 10^ baby steps and 10^ giant steps in 
a function field F^(a;, y) with q = 10* + 39 and = GH^, where G and H were 
random, monic, co-prime, irreducible polynomials with deg(G') > deg(iJ). 

In the next section, we briefly review the method of |21j implemented here to 
compute the divisor class number of a cubic function field. 

4. Computing h and R - the Idea 

Algorithm [3] lists the three main phases of the method of Scheidler and Stein 
pn [22] to compute a multiple ho of exp{TZ). If exp(7?.) is large enough, then these 
three steps determine the divisor class number ft, of a cubic function field. Step 4 
determines exp(7?.) and in certain cases. Step 5 computes the regulator R and ideal 
class number of C 

If exp(7?.) < 2U, then there may be more than one multiple of exp(7?,) in the 
interval {E — U, E + U), in which case h cannot be determined. Nonetheless, h is 
limited to a smaller subset, since exp(7^) | h. We know that R/ exp(7?,) is a divisor 
of d := gcd(exp(7?.), /i/ exp(72.)); if d = 1, then R = exp{TZ). 

By results of Achter and Pries [U [2] , the class numbers of purely cubic function 
fields of genus g over a finite field behave like random integers in the Hasse-Weil 
interval [{^/q — 1)^^, (^g -|- 1)^^] with respect to divisibility. Therefore, the class 
numbers are very often square-free, whence the divisor class group J7 is cyclic. In 
that case, exp(7?.) = R, and if one assumes that Vq /V^ behaves like a random 
subgroup of J', then R is large. Therefore, Algorithm |3] can determine R and h in 
many cases. 

For details on how to compute E and U in Step 1, along with the complete 
analysis of the running time of Algorithm [31 see (211 122) . Further implementation 
details may be found in [11]. Here we merely state that by (21] [S^, for 5 > 3, the 
complexity of Step 1 of Algorithm [3] is O (^q^'^^9-i)/5]+£(g)'^ giant steps, as 5 — 00, 
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Algorithm 3 Computing h and/or R - the Idea 
1: Determine E,U gN such that h £ (E - U, E + U). 

2: Determine extra information about h such as congruences or the distribution 

of h in the interval {E -U, E + U). 
3: Compute a multiple ho of exp(7?.) via Algorithm [2l 
4: Compute R* := exp{TZ) via Algorithm |31 

5: If R* > 2U, let h be the unique muhiple of R* in {E - U, E + U). If 
gcd{R*,h/R*) = 1, then R = R* and ho = h/R*. 



where —1/4 < e{g) < 1/2. If 5 < 2, then there is no asymptotic improvement in 
using the bounds described in [21] [22] versus the Hasse-Weil bounds. 

Next, we discuss some practical issues arising in our implementation of Algo- 
rithm [31 We omit details on Step 3 since they were already given in Section [3| 

5. Implementation Details 

5.1. Implementation Details for Phase 2. For Phase 2 of Algorithm[31 we use 
extra information about h to effectively reduce the size of the interval, {E — U, E + 
U), determined in Phase 1. The method to compute E and U uses a truncated 
Euler product representation of the zeta function of the function field, and we 
consider finite places (i.e., monic irreducible polynomials) up to a degree bound A. 
It has been shown in both the quadratic and cubic function field cases that h is not 
uniformly distributed in this interval, and tends to be close to the approximation 

E |1H1[II]. 

Let a{q, g) = MeanQh — E\/U), where the mean is taken over all cubic function 
fields of genus g over ¥q{x). In Theorem [2l we described how to apply a{q,g) to 
minimize the expected running time of Algorithm [2] For a fixed genus g, we assume 
that the limit a{g) = limg_>.oo Oi{q, g) exists, as is the case for hyperelliptic function 
fields [28]. However, a{q, g) and a{g) are very difficult to compute precisely, so 
instead we applied approximations a{g) of a{g) for 3 < g < 7. Table [1] (Table 6.5 
of [11]) lists these approximations for selected values of g, based on a sampling of 
10000 cubic function fields of genus g over a fixed field F^. However, these averages 
may be applied to cubic function fields over any finite field. In Table [1] A is the 
degree bound used to compute the estimate E. 

A second component of Phase 2 of Algorithm[3]finds information about h modulo 
small primes. In |4], Bauer, Teske, and Weng consider purely cubic function fields 
defined by Picard curves. In this case, they proved the following result about h 
modulo powers of 3. 

Proposition 2 (Lemma 2.2 of 4 ). Let K = ¥q{x^y) he the function field of a 
Picard curve C : = F{x), where q = 1 (mod 3). If F has k distinct irreducible 
factors over ¥q[x], then 3'^"^ \ h. If F is irreducible, then h = l (mod 3). 

The genus 3 curves we used in our computations are birationally equivalent to 
Picard curves, so we applied this proposition to these curves. 

5.2. Implementation Details for Phase 4. Algorithm [4] outlines the procedure 
for Step 4 of Algorithm [3} This step will determine exp{TZ) given a multiple ho of 
exp{Tl). Here, we adapt Algorithm 4.4 of [30] to the case of cubic function fields 
of unit rank 2, using the fact that exp{TZ) is the smallest factor R* of ho such that 
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Algorithm 4 Computing exp{TZ): Step 4 of Algoritlini |3] 

Input: A multiple ho of exp(TZ) and a lower bound I of exp{TZ). 
Output: The exponent exp(7?.) of the infrastructure TZ. 

1: Set h* ■= 1. 

2: Factor ho=llLiPT- 

3: for i = 1 to fc do 

4: if Pi < ho /I then 

5: Find 1 < Ci < Gi minimal such that id{B {ho/p^' ,0)) ^ O. 

6: Set h* ■.= p'r^-^h*. 

7: return exp(7?,) = R* := ho/h*. 



id{B{R*,0)) = O. Recall that B{a,0), for a € N, may be impossible to determine 
because of a hidden element having distance (a, 0). Nevertheless, the probability of 
this occurring is negligible, so that we can assume that Algorithm |3] produces the 
correct output. 

We briefly comment on the running time of Algorithm |4] relative to the running 
time of Algorithm [31 especially in light of the factorization in Step[2j First, current 
heuristic methods to factor the integer ho require a subexponential number of bit 
operations in log(/io). Furthermore, Step 3 only requires a polynomial number (in 
g and \og(q)) of infrastructure operations. Therefore, determining exp(7?,) from ho 
will not dominate the overall running time of Algorithm |3l The class numbers that 
we found required only a few seconds to factor. In fact, we simply used a basic 
implementation of Pollard's Rho method for factoring [14) . 

6. Computational Results 

In this section, we tested the practical effectiveness of the Kangaroo algorithm 
to compute the divisor class number and extracted the ideal class number and 
regulator of six purely cubic function fields of unit rank 2: five of genus 3 and 
one of genus 4. We remark that this is the first time that Algorithm [3] has been 
implemented for cubic function fields of unit rank 2. 

The genus 3 curves that we used for the examples in this section were each of 
the form d : = Gi{x)x^, where 

Gi{x) =x^ + 858028a;3 + 786068a;2 + 69746x + 675670 , 
G2(x) =x^ + 9655935x3 8633555x2 13194253; + 1437614 , 
Galx) ^x'^ + 63268943x3 + 53257730^^ + 59385220x + 16188628 , 
Gilx) ^x'^ + 834364201x3 + 8363484x2 + 953863416x + 850202733 , 
G5(x) = x4 + 9994854268x3 + 7631258748x2 + 7469686108x + 292775976 , 

and the genus 4 curve was of the form Cq : y3 — Ge{x), where 

Geix) = x^ + 4207x5 + 3340x4 + 9858x3 ^ i^qi^^ + 36a; + 1019 . 

Each Gi is irreducible over the field used, and q = I (mod 3) is prime. 

In Table [H we list the ideal class number ho , the regulator R, and the ratio 
\h — E\/U for these six examples. For the genus 3 examples, we used p — 3.02410 
and T = p/3 = 1.00803, and for the genus 4 example, we used p = t = 4.03846. 
Based on the last column, we see that the estimate E was better than average 
except for the computations with curves C3 and C4. The C4 through Ce examples 
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were computed via a parallelized approach, using up to 64 processors. The largest 
divisor class number we computed had 31 decimal digits. 

Data from the Kangaroo computations is given in Table |31 Here, "BS Jumps" 
and "GS Jumps" refer to the respective number of baby steps and giant steps 
computed using the Kangaroo method in each example, Ig 9 is the base 2 logarithm 
of the value of 6 used for setting traps, "Traps" is the total number of traps that 
were set, m is the number of processors (or kangaroos) that were used, "Coll." is 
the number of useless collisions in the given example, and "Time" refers to the 
total time taken by the computation in minutes, hours, and days. For timing 
and technical considerations, we implemented our algorithms in C++ using NTL, 
written by Shoup [26], compiled using g++, and run on IBM cluster nodes with Intel 
Pentium 4 Xeon 2.4 GHz processors and 2 GB of RAM running Redhat Enterprise 
Linux 3. 
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Table 2. Regulators and Ideal Class Numbers 
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Table 3. Regulator Computation Data 



7. Conclusions and Future Work 

Using current implementations of the arithmetic in the infrastructure of a purely 
cubic function field of unit rank 2, divisor class numbers and regulators up to 31 
digits were computed using the method of Scheidler and Stein [21] and the Kan- 
garoo algorithm as a subroutine. The largest example among these class numbers 
and regulators was the largest ever computed for a function field of genus at least 
3, with the exception of function fields defined by a Picard curve. This was also the 
first time that a "square-root" algorithm was efficiently applied to the infrastruc- 
ture TZ oi a global field of unit rank 2. Moreover, we made improvements to the 
Kangaroo method in TZ by showing how to take advantage of information on the 
congruence class of the divisor class number and how to use the ratio p — Tq/Tb 
more effectively. 
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A procedure to determine the regulator given the divisor class number and in- 
frastructure exponent using methods of Buchmann, Jacobson, and Teske [5j |32] is 
work in progress. In addition, efficient ideal and infrastructure arithmetic needs 
to be developed for arbitrary (i.e., not necessarily purely) cubic function fields as 
well as for characteristic 2 and 3 in order to apply this method to such function 
fields. Finally, it is unknown if we can take advantage of the torus structure of TZ 
to compute R using more efficient techniques. 
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